Hi All
I have the same infection on my windows server 2008 r2 system as descibed in this post:
http://forum.avast.com/index.php?topic=82254.0
Would anyone be able to help me with removing the infection using OTS please?
Many Thanks
Andy
Hi All
I have the same infection on my windows server 2008 r2 system as descibed in this post:
http://forum.avast.com/index.php?topic=82254.0
Would anyone be able to help me with removing the infection using OTS please?
Many Thanks
Andy
Lets have a shufti then
Download OTL to your Desktop
[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in
[b]netsvcs
%SYSTEMDRIVE%*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U*.* /s
%Temp%\smtmp\1*.*
%Temp%\smtmp\2*.*
%Temp%\smtmp\3*.*
%Temp%\smtmp\4*.*
C:\commands.txt echo list vol /raw /hide /c
/wait
C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
erase c:\commands.txt /hide /c
/wait
erase c:\diskreport.txt /hide /c
CREATERESTOREPOINT[/b]
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs
THEN
Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the “Scan” button to start scan
http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRScan.gif
On completion of the scan click save log, save it to your desktop and post in your next reply
http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRsavelog.gif
Thanks Essexboy, I will try this later tonight as its a Terminal Server and it has 10 people logged into it at the moment and dont want to disturb them too much unless you thinks its cool to grab the logs even if they are logged on?
It may slow it down a bit as the programmes run, so the choice is yours - unless you think it may be on one of the consoles
I took a chance and ran the software! I have the logs files although they are too big to post on the forum because of the character limits. Do you have an email address I could send these too please?
Could you attach them ?
hope this works
Run this and let me know if the problem persists
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from “Start with Windows”
Reboot and then run OTL
http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL IE - HKLM\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012032807&ptnrS=YKxdm070YYgb&si=&n=77ed2f27&psa=&st=sb&searchfor={searchTerms} IE - HKU\S-1-5-21-2842197145-585572594-54396217-1149\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011806&ptnrS=YKxdm070YYgb&si=&n=77ecdd1e&psa=&st=sb&searchfor={searchTerms} IE - HKU\S-1-5-21-2842197145-585572594-54396217-1184\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011812&ptnrS=YKxdm070YYgb&si=&n=77ecdd24&psa=&st=sb&searchfor={searchTerms} IE - HKU\S-1-5-21-2842197145-585572594-54396217-1185\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011805&ptnrS=YKxdm070YYgb&si=&n=77ecdd1d&psa=&st=sb&searchfor={searchTerms} IE - HKU\S-1-5-21-2842197145-585572594-54396217-2088\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011805&ptnrS=YKxdm070YYgb&si=&n=77ecdd1d&psa=&st=sb&searchfor={searchTerms} IE - HKU\S-1-5-21-2842197145-585572594-54396217-4130\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012012304&ptnrS=YKxdm070YYgb&si=&n=77ecdf10&psa=&st=sb&searchfor={searchTerms} O3 - HKU\S-1-5-21-2842197145-585572594-54396217-1149\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found O3 - HKU\S-1-5-21-2842197145-585572594-54396217-1184\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found O3 - HKU\S-1-5-21-2842197145-585572594-54396217-1185\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found O3 - HKU\S-1-5-21-2842197145-585572594-54396217-4130\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found O4 - HKU\S-1-5-21-2842197145-585572594-54396217-4130..\Run: [NgoErbjm] C:\Users\alockwood\AppData\Local\fawrhxay\ngoerbjm.exe () O4 - HKU\S-1-5-21-2842197145-585572594-54396217-4130..\Run: [Opxoneizu] C:\Users\alockwood\AppData\Roaming\Ohaput\imaxz.exe File not found O4 - Startup: C:\Users\alockwood\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ngoerbjm.exe () [2012/04/18 10:42:25 | 000,000,000 | ---D | M] -- C:\Users\alockwood\AppData\Roaming\Evvyw [2012/04/18 11:42:09 | 000,000,000 | ---D | M] -- C:\Users\alockwood\AppData\Roaming\Ohaput:Files
ipconfig /flushdns /c
C:\Users\alockwood\AppData\Local\fawrhxay:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
After scan fix, please see attached log. Thanks Essexboy
How is it behaving now ?
Same as before I’m afraid, the user still gets the annoying command processor want’s to run when logging into his profile and I can see the virus exe trying to launch…thanks for your help on this, really do appreciate it
In that case could you run OTL on the users system as opposed to the server
Use the same scan script